Systems and methods for external detection of misconfigured systems

ABSTRACT

A computer-implemented method is provided for external detection of a vulnerable system coupled to a communication network. The method can include measuring communication traffic on the communication network to identify one or more domain names, which in turn can originate from server systems in the communication network. The method can further include identifying the domain names based on metadata from the domain names and/or the measured communication traffic, where each domain name has an associated property indicative of its vulnerability. The method can further include determining whether any one (or more) of the domain names is registered at a domain name registry and, if the domain name is not registered, registering the domain name.

TECHNICAL FIELD

The following disclosure is directed to methods and systems fordetecting vulnerable systems, and, more specifically, methods andsystems for detecting vulnerable systems based on domain nameproperties.

BACKGROUND

In an age of increased cybercrime and varied cybersecurity efforts,detecting vulnerabilities before, or within real-time, a security flawis exploited can be a true business advantage to companies, governments,institutions, and individuals. In many instances, there are benign butmisconfigured systems having these security flaws that become targetsfor parties with nefarious intentions. Every day, seemingly endlesstypes and numbers of malignant actors exploit security flaws for thepurpose of theft (both monetary and of data), espionage, frustration(e.g., denial of service attacks and mass spamming), terrorism, andmore. However, the resources necessary to get ahead of these potentialthreats can be astounding and unfeasible.

SUMMARY

Domain names on the Internet can be a specific source of security flawsand, often, speed in detecting exploitation of domain names becomescrucial to overcoming attacks. To track and detect security flaws inreal time, or near real time, systems and methods can monitorcommunication traffic and extract metadata related to the traffic and/ordomain names to detect vulnerable systems.

In accordance with an embodiment of the disclosure, acomputer-implemented method is provided for external detection of avulnerable system coupled to a communication network. The method caninclude measuring communication traffic on the communication network toidentify one or more domain names, which in turn can originate fromserver systems in the communication network. The method can furtherinclude identifying the domain names based on metadata from the domainnames and/or the measured communication traffic, where each domain namehas an associated property indicative of its vulnerability. The methodcan further include determining whether any one (or more) of the domainnames is registered at a domain name registry and, if the domain name isnot registered, registering the domain name.

Embodiments of the methods can include one or more of the followingfeatures. Domain names having the property indicative of vulnerabilitycan be: (i) an unregistered domain name, (ii) a malfunctioning domainname, (iii) an abandoned domain name, and/or (iv) an algorithm-generateddomain name. The vulnerable system can be a malware-infected serversystem and/or , a misconfigured server system.

In some embodiments, the metadata can include a geographical locationassociated with each domain name. If so, the registration of the domainname based on the extracted metadata includes registering the domainname based on a high frequency of domain names having a propertyindicative of vulnerability in a particular geographical location. Themethod can further include associating the registered domain name with aserver system configured to monitor communication traffic to theregistered domain name, and, in some instances, detecting the vulnerablesystem associated with the registered domain name. Measuringcommunication traffic to each of the plurality of domain names canfurther include receiving communication traffic data from one or moreInternet service providers (ISP), comparing relative magnitude ofcommunication traffic to an expected amount of traffic, and/or measuringa frequency of communication traffic to the domain name.

In accordance with another embodiment of the disclosure, a systemincluding one or more computer systems programmed to perform operationsis provided. The operations include measuring communication traffic inthe communication network to identify one or more domain names, wherethe communication traffic originates from server systems in thecommunication network. The domain names are based on metadata from (i)the domain names and/or (ii) the measured communication traffic, whereeach domain name has an associated property indicative of itsvulnerability. The operations further include determining whether anyone (or more) of the domain names is registered at a domain nameregistry, and if the domain name is not registered, registering thedomain name.

Embodiments of the systems can include one or more of the followingfeatures. Domain names having the property indicative of vulnerabilitycan be: (i) an unregistered domain name, (ii) a malfunctioning domainname, (iii) an abandoned domain name, and/or (iv) an algorithm-generateddomain name. The vulnerable system can be a malware-infected serversystem and/or, a misconfigured server system.

In some embodiments, the metadata can include a geographical locationassociated with each domain name. If so, the registration of the domainname based on the extracted metadata includes registering the domainname based on a high frequency of domain names having a propertyindicative of vulnerability in a particular geographical location. Themethod can further include associating the registered domain name with aserver system configured to monitor communication traffic to theregistered domain name, and, in some instances, detecting the vulnerablesystem associated with the registered domain name. Measuringcommunication traffic to each of the plurality of domain names canfurther include receiving communication traffic data from one or moreInternet service providers (ISP), comparing relative magnitude ofcommunication traffic to an expected amount of traffic, and/or measuringa frequency of communication traffic to the domain name.

BRIEF DESCRIPTION OF THE DRAWINGS

FIGS. 1A-1B are flowcharts of exemplary embodiments of methods fordetecting vulnerable systems coupled to a communication network.

FIG. 2 is a diagram of an exemplary embodiment of a system for detectingvulnerable systems coupled to a communication network.

FIG. 3 is a block diagram of an example computer system that may be usedin implementing the systems and methods described herein.

DETAILED DESCRIPTION

Disclosed herein are exemplary embodiments of systems and methods fordetecting vulnerable systems in communication networks. These vulnerablesystems can include one or more computing systems, one or more serversystems, or other networked systems. In many instances, vulnerablesystems are associated with domain names on the Internet. “Domainnames,” as used herein, may refer to registered or unregistered names,addresses, and/or links to a resource on the Internet.

Some domain names may be associated with vulnerable resources. In someembodiments, an algorithm may generate links to domain names that arenot registered or generated in error.

For example, an algorithm that links to “google.com” may incorrectlygenerate links such as “gooooogle.com” or “goggle.com.” In anotherembodiment, an application developer may register a domain name for alegitimate service or business. If the business associated with thedomain name closes, and the domain name is abandoned, the domain namemay become expired or “dropped” from the registry. If so, the registrymay delete the domain name (de-register) and the domain name may becomeavailable to another party. In another embodiment, a registered domainname may be associated with a misconfigured system. For example, themisconfigured system may be operating with security flaws that open thesystem to security risks. In another embodiment, parties acting withnefarious intentions (criminals or criminal groups, malignantstate-sponsored actors, etc.) may register domain names for their ownpurposes (e.g., malware, botnets, etc.). In another embodiment, ananti-virus software program may try to contact domain names repeatedlybased on some acquired misinformation. If so, that domain name will haverepeat incoming traffic. Examples of detection of botnets is discussedin CONDENSER: A Graph-Based Approach for Detecting Botnets, by Camelo etal., and in Botnet Cluster Identification (Master Thesis), by PedroCamelo, each of which are incorporated herein by reference.

The below described exemplary systems and methods are configured toidentify such domain names, and in some embodiments, identify one ormore vulnerable systems associated with such domain names. For thepurpose of clarity and conciseness, the methods and systems of FIGS.1A-3 are discussed below together.

Detection Systems and Methods

FIGS. 1A-1B are flowcharts of exemplary embodiments of methods fordetecting vulnerable systems coupled to a communication network. FIG. 2is a diagram of an exemplary embodiment of an environment 200 in which asystem for detecting vulnerable systems coupled to, or part of, acommunication network operates.

In step 102, the detection system 202 measures communication traffic inthe communication network to identify a plurality of domain names ofinterest. The communication traffic can be originating from one or moreexternal (separate from the system 200) server systems 204 in thecommunication network. External server systems can include companyservers, desktop computers, Internet of things (IoT) devices, mobiledevices, or any other device on external networks. In some embodiments,the communication traffic can be provided by one or more Internetservice providers (ISPs). Many ISPs track communication traffic todomain names for standard business purposes. However, the monitoringand/or measuring of communication traffic is typically associated withlarge amounts of data. Thus, in some embodiments, metadata related tothe measured communication traffic may be extracted from thecommunication traffic in the interest of efficiency. Meta data caninclude geographical location of the communication traffic, frequency ofthe communication traffic, magnitude of the communication traffic,aggregated counters of a number of unique Internet Protocol (IP)addresses per country, a number of events observed per period (e.g.,every hour), a ratio between unique IPs versus a sum of a portion or allcommunication traffic. Efficiency may be crucial in some instances wherea domain name may be associated with a flawed, but important Internetresource that is vulnerable to malware. In some embodiments, the ISPscan provide a list of domain names that are the subject of networktraffic. This list of domain names can be analyzed to identify thosethat may be addresses for vulnerable systems. In some embodiments, thedetection of nonexistent domain names being contacted by a group ofdevices does not necessarily map to malicious behavior. In some cases,the behavior can be mapped to a control failure associated with asoftware or service dependent on those domains. When that controlfailure occurs, the affected devices can become vulnerable to maliciousactors that can potentially acquire the nonexistent domains and gaincontrol over the associated devices.

In step 104, the detection system 202 identifies one or more domainnames (1 through N) that each are vulnerable with regard to someproperty or attribute. For example, the domain name can have thefollowing conditions associated therewith: (i) an unregistered domainname, (ii) a malfunctioning domain name, (iii) an abandoned domain name,and/or (iv) an algorithm-generated domain name. In some embodiments, thedomain names can be identified based on the metadata extracted from themeasured communication traffic and/or the domain names themselves. Forexample, a domain name may be identified based on statistical anomaliesregarding traffic emanating from or directed to the domain name, orsuspicious IP header information extracted from packets directed to thedomain name. Examples include identification of a group of systems ordevices attempting to contact nonexistent domain names at a givenfrequency, from a given set of geographies, and/or using specificprotocols and/or payloads. This group of devices interacting with one ormore domains, using a similar pattern and/or frequency, may beassociated with automated traffic generated by malware, or may be causedby mis-configurations of machine-to-machine communication.

One important advantage to extracting metadata of the communicationtraffic is that much (or all) of the data from the traffic andassociated parameters do not have to be stored. Instead, a detectionsystem 202 can include a streaming server 206 that executes queries onthe data in real time or near real time. In some embodiments, theextracted metadata can include geographical information related to thecommunication traffic. If so, for example, the detection system 202 candetect a group of domain names associated with a particular geography(such a city or region of a country) with significant incoming traffic.In some embodiments, the relative magnitude of traffic (or “cluster” oftraffic) may be measured to identify domain names. For example, if oneor a handful of parties are pinging “gogle.com,” it is likely a mistake(such as mistyping). However, if thousands of parties are pinging thesame domain name “gogle.com,” the detection system 202 may identify thatdomain name as a candidate for registration. Thus, the measured trafficmay be compared against an expected amount of traffic for the purpose ofdetection. Measures of expected amounts of traffic may be available fromthe ISPs themselves or other services. In another embodiment, thefrequency of the traffic may be measured. An anomalous pattern ofcontacting a domain name may signify a vulnerability. For example, ifthe system 202 detects a group of devices periodically attempting tocontact a domain, or group of domains, at a given frequency (forexample, each hour), such a detection can be indicative of automatedmalicious traffic.

In some embodiments, the traffic data and/or data regarding the domainnames may be stored and analyzed by accessing the storage 208. Bydetermining one or more domain names having a vulnerable property orattribute, the detection system can ultimately detect and/or identifyone or more vulnerable systems 210 associated with the domain name.

In step 106, the detection system 202 is configured to determine whethereach domain name is registered at a domain name registry. In step 108,if the domain name is not registered, then the system 202 is configuredto register the domain name. Once registered, in step 110, the system202 can associate the registered domain name with a server system 212configured to monitor communication traffic to the registered domainname. The server system 212 may be controlled by the detection system202. In step 112, the detection system 202 can identify and/or detectone or more vulnerable systems associated with the registered domainname. Once the domain name (e.g., domain name 2 of FIG. 2) has beenacquired and configured on the server system 212, the vulnerablesystem(s) 210 will typically contact the domain on the server system 212using a specific network protocol and payload. Inspecting the networkrequest by the vulnerable system 210 allows the detection system 202 toassociate the vulnerable system(s) with malicious or other anomalousbehavior that triggered the domain communication.

Computer-Based Implementations

In some examples, some or all of the processing described above can becarried out on a personal computing device, on one or more centralizedcomputing devices, or via cloud-based processing by one or more servers.In some examples, some types of processing occur on one device and othertypes of processing occur on another device. In some examples, some orall of the data described above can be stored on a personal computingdevice, in data storage hosted on one or more centralized computingdevices, or via cloud-based storage. In some examples, some data arestored in one location and other data are stored in another location. Insome examples, quantum computing can be used. In some examples,functional programming languages can be used. In some examples,electrical memory, such as flash-based memory, can be used.

FIG. 3 is a block diagram of an example computer system 300 that may beused in implementing the technology described in this document.General-purpose computers, network appliances, mobile devices, or otherelectronic systems may also include at least portions of the system 300.The system 300 includes a processor 310, a memory 320, a storage device330, and an input/output device 340. Each of the components 310, 320,330, and 340 may be interconnected, for example, using a system bus 350.The processor 310 is capable of processing instructions for executionwithin the system 300. In some implementations, the processor 310 is asingle-threaded processor. In some implementations, the processor 310 isa multi-threaded processor. The processor 310 is capable of processinginstructions stored in the memory 320 or on the storage device 330.

The memory 320 stores information within the system 300. In someimplementations, the memory 320 is a non-transitory computer-readablemedium. In some implementations, the memory 320 is a volatile memoryunit. In some implementations, the memory 320 is a non-volatile memoryunit.

The storage device 330 is capable of providing mass storage for thesystem 300. In some implementations, the storage device 330 is anon-transitory computer-readable medium. In various differentimplementations, the storage device 330 may include, for example, a harddisk device, an optical disk device, a solid-date drive, a flash drive,or some other large capacity storage device. For example, the storagedevice may store long-term data (e.g., database data, file system data,etc.). The input/output device 340 provides input/output operations forthe system 300. In some implementations, the input/output device 340 mayinclude one or more of a network interface devices, e.g., an Ethernetcard, a serial communication device, e.g., an RS-232 port, and/or awireless interface device, e.g., an 802.11 card, a 3G wireless modem, ora 4G wireless modem. In some implementations, the input/output devicemay include driver devices configured to receive input data and sendoutput data to other input/output devices, e.g., keyboard, printer anddisplay devices 360. In some examples, mobile computing devices, mobilecommunication devices, and other devices may be used.

In some implementations, at least a portion of the approaches describedabove may be realized by instructions that upon execution cause one ormore processing devices to carry out the processes and functionsdescribed above. Such instructions may include, for example, interpretedinstructions such as script instructions, or executable code, or otherinstructions stored in a non-transitory computer readable medium. Thestorage device 330 may be implemented in a distributed way over anetwork, such as a server farm or a set of widely distributed servers,or may be implemented in a single computing device.

Although an example processing system has been described in FIG. 3,embodiments of the subject matter, functional operations and processesdescribed in this specification can be implemented in other types ofdigital electronic circuitry, in tangibly-embodied computer software orfirmware, in computer hardware, including the structures disclosed inthis specification and their structural equivalents, or in combinationsof one or more of them. Embodiments of the subject matter described inthis specification can be implemented as one or more computer programs,i.e., one or more modules of computer program instructions encoded on atangible nonvolatile program carrier for execution by, or to control theoperation of, data processing apparatus. Alternatively or in addition,the program instructions can be encoded on an artificially generatedpropagated signal, e.g., a machine-generated electrical, optical, orelectromagnetic signal that is generated to encode information fortransmission to suitable receiver apparatus for execution by a dataprocessing apparatus. The computer storage medium can be amachine-readable storage device, a machine-readable storage substrate, arandom or serial access memory device, or a combination of one or moreof them.

The term “system” may encompass all kinds of apparatus, devices, andmachines for processing data, including by way of example a programmableprocessor, a computer, or multiple processors or computers. A processingsystem may include special purpose logic circuitry, e.g., an FPGA (fieldprogrammable gate array) or an ASIC (application specific integratedcircuit). A processing system may include, in addition to hardware, codethat creates an execution environment for the computer program inquestion, e.g., code that constitutes processor firmware, a protocolstack, a database management system, an operating system, or acombination of one or more of them.

A computer program (which may also be referred to or described as aprogram, software, a software application, a module, a software module,a script, or code) can be written in any form of programming language,including compiled or interpreted languages, or declarative orprocedural languages, and it can be deployed in any form, including as astandalone program or as a module, component, subroutine, or other unitsuitable for use in a computing environment. A computer program may, butneed not, correspond to a file in a file system. A program can be storedin a portion of a file that holds other programs or data (e.g., one ormore scripts stored in a markup language document), in a single filededicated to the program in question, or in multiple coordinated files(e.g., files that store one or more modules, sub programs, or portionsof code). A computer program can be deployed to be executed on onecomputer or on multiple computers that are located at one site ordistributed across multiple sites and interconnected by a communicationnetwork.

The processes and logic flows described in this specification can beperformed by one or more programmable computers executing one or morecomputer programs to perform functions by operating on input data andgenerating output. The processes and logic flows can also be performedby, and apparatus can also be implemented as, special purpose logiccircuitry, e.g., an FPGA (field programmable gate array) or an ASIC(application specific integrated circuit).

Computers suitable for the execution of a computer program can include,by way of example, general or special purpose microprocessors or both,or any other kind of central processing unit. Generally, a centralprocessing unit will receive instructions and data from a read-onlymemory or a random access memory or both. A computer generally includesa central processing unit for performing or executing instructions andone or more memory devices for storing instructions and data. Generally,a computer will also include, or be operatively coupled to receive datafrom or transfer data to, or both, one or more mass storage devices forstoring data, e.g., magnetic, magneto optical disks, or optical disks.However, a computer need not have such devices. Moreover, a computer canbe embedded in another device, e.g., a mobile telephone, a personaldigital assistant (PDA), a mobile audio or video player, a game console,a Global Positioning System (GPS) receiver, or a portable storage device(e.g., a universal serial bus (USB) flash drive), to name just a few.

Computer readable media suitable for storing computer programinstructions and data include all forms of nonvolatile memory, media andmemory devices, including by way of example semiconductor memorydevices, e.g., EPROM, EEPROM, and flash memory devices; magnetic disks,e.g., internal hard disks or removable disks; magneto optical disks; andCD-ROM and DVD-ROM disks. The processor and the memory can besupplemented by, or incorporated in, special purpose logic circuitry.

To provide for interaction with a user, embodiments of the subjectmatter described in this specification can be implemented on a computerhaving a display device, e.g., a CRT (cathode ray tube) or LCD (liquidcrystal display) monitor, for displaying information to the user and akeyboard and a pointing device, e.g., a mouse or a trackball, by whichthe user can provide input to the computer. Other kinds of devices canbe used to provide for interaction with a user as well; for example,feedback provided to the user can be any form of sensory feedback, e.g.,visual feedback, auditory feedback, or tactile feedback; and input fromthe user can be received in any form, including acoustic, speech, ortactile input. In addition, a computer can interact with a user bysending documents to and receiving documents from a device that is usedby the user; for example, by sending web pages to a web browser on auser's user device in response to requests received from the webbrowser.

Embodiments of the subject matter described in this specification can beimplemented in a computing system that includes a back end component,e.g., as a data server, or that includes a middleware component, e.g.,an application server, or that includes a front end component, e.g., aclient computer having a graphical user interface or a Web browserthrough which a user can interact with an implementation of the subjectmatter described in this specification, or any combination of one ormore such back end, middleware, or front end components. The componentsof the system can be interconnected by any form or medium of digitaldata communication, e.g., a communication network. Examples ofcommunication networks include a local area network (“LAN”) and a widearea network (“WAN”), e.g., the Internet. The computing system caninclude clients and servers. A client and server are generally remotefrom each other and typically interact through a communication network.The relationship of client and server arises by virtue of computerprograms running on the respective computers and having a client-serverrelationship to each other.

While this specification contains many specific implementation details,these should not be construed as limitations on the scope of what may beclaimed, but rather as descriptions of features that may be specific toparticular embodiments. Certain features that are described in thisspecification in the context of separate embodiments can also beimplemented in combination in a single embodiment. Conversely, variousfeatures that are described in the context of a single embodiment canalso be implemented in multiple embodiments separately or in anysuitable sub-combination. Moreover, although features may be describedabove as acting in certain combinations and even initially claimed assuch, one or more features from a claimed combination can in some casesbe excised from the combination, and the claimed combination may bedirected to a sub-combination or variation of a sub-combination.

Similarly, while operations are depicted in the drawings in a particularorder, this should not be understood as requiring that such operationsbe performed in the particular order shown or in sequential order, orthat all illustrated operations be performed, to achieve desirableresults. In certain circumstances, multitasking and parallel processingmay be advantageous. Moreover, the separation of various systemcomponents in the embodiments described above should not be understoodas requiring such separation in all embodiments, and it should beunderstood that the described program components and systems cangenerally be integrated together in a single software product orpackaged into multiple software products.

Particular embodiments of the subject matter have been described. Otherembodiments are within the scope of the following claims. For example,the actions recited in the claims can be performed in a different orderand still achieve desirable results. As one example, the processesdepicted in the accompanying figures do not necessarily require theparticular order shown, or sequential order, to achieve desirableresults. In certain implementations, multitasking and parallelprocessing may be advantageous. Other steps or stages may be provided,or steps or stages may be eliminated, from the described processes.Accordingly, other implementations are within the scope of the followingclaims.

Terminology

The phraseology and terminology used herein is for the purpose ofdescription and should not be regarded as limiting.

The term “approximately”, the phrase “approximately equal to”, and othersimilar phrases, as used in the specification and the claims (e.g., “Xhas a value of approximately Y” or “X is approximately equal to Y”),should be understood to mean that one value (X) is within apredetermined range of another value (Y). The predetermined range may beplus or minus 20%, 10%, 5%, 3%, 1%, 0.1%, or less than 0.1%, unlessotherwise indicated.

The indefinite articles “a” and “an,” as used in the specification andin the claims, unless clearly indicated to the contrary, should beunderstood to mean “at least one.” The phrase “and/or,” as used in thespecification and in the claims, should be understood to mean “either orboth” of the elements so conjoined, i.e., elements that areconjunctively present in some cases and disjunctively present in othercases. Multiple elements listed with “and/or” should be construed in thesame fashion, i.e., “one or more” of the elements so conjoined. Otherelements may optionally be present other than the elements specificallyidentified by the “and/or” clause, whether related or unrelated to thoseelements specifically identified. Thus, as a non-limiting example, areference to “A and/or B”, when used in conjunction with open-endedlanguage such as “comprising” can refer, in one embodiment, to A only(optionally including elements other than B); in another embodiment, toB only (optionally including elements other than A); in yet anotherembodiment, to both A and B (optionally including other elements); etc.

As used in the specification and in the claims, “or” should beunderstood to have the same meaning as “and/or” as defined above. Forexample, when separating items in a list, “or” or “and/or” shall beinterpreted as being inclusive, i.e., the inclusion of at least one, butalso including more than one, of a number or list of elements, and,optionally, additional unlisted items. Only terms clearly indicated tothe contrary, such as “only one of” or “exactly one of,” or, when usedin the claims, “consisting of,” will refer to the inclusion of exactlyone element of a number or list of elements. In general, the term “or”as used shall only be interpreted as indicating exclusive alternatives(i.e. “one or the other but not both”) when preceded by terms ofexclusivity, such as “either,” “one of,” “only one of,” or “exactly oneof.” “Consisting essentially of,” when used in the claims, shall haveits ordinary meaning as used in the field of patent law.

As used in the specification and in the claims, the phrase “at leastone,” in reference to a list of one or more elements, should beunderstood to mean at least one element selected from any one or more ofthe elements in the list of elements, but not necessarily including atleast one of each and every element specifically listed within the listof elements and not excluding any combinations of elements in the listof elements. This definition also allows that elements may optionally bepresent other than the elements specifically identified within the listof elements to which the phrase “at least one” refers, whether relatedor unrelated to those elements specifically identified. Thus, as anon-limiting example, “at least one of A and B” (or, equivalently, “atleast one of A or B,” or, equivalently “at least one of A and/or B”) canrefer, in one embodiment, to at least one, optionally including morethan one, A, with no B present (and optionally including elements otherthan B); in another embodiment, to at least one, optionally includingmore than one, B, with no A present (and optionally including elementsother than A); in yet another embodiment, to at least one, optionallyincluding more than one, A, and at least one, optionally including morethan one, B (and optionally including other elements); etc.

The use of “including,” “comprising,” “having,” “containing,”“involving,” and variations thereof, is meant to encompass the itemslisted thereafter and additional items.

Use of ordinal terms such as “first,” “second,” “third,” etc., in theclaims to modify a claim element does not by itself connote anypriority, precedence, or order of one claim element over another or thetemporal order in which acts of a method are performed. Ordinal termsare used merely as labels to distinguish one claim element having acertain name from another element having a same name (but for use of theordinal term), to distinguish the claim elements.

1-20. (canceled)
 21. A computer-implemented method for externaldetection of a vulnerable system, the vulnerable system coupled to acommunication network based on domain name properties, the methodcomprising: receiving communication traffic in the communication networkto identify at least one domain name associated with a vulnerablesystem, the communication traffic originating from at least one serversystem in the communication network; executing queries on thecommunication traffic to extract metadata while monitoring thecommunication traffic; identifying the domain name having an associatedproperty indicative of vulnerability of the domain name based on themetadata, wherein the domain name having the associated propertyindicative of vulnerability comprises a misconfigured domain name;determining whether the misconfigured domain name is registered at adomain name registry; if the misconfigured domain name is notregistered, registering the misconfigured domain name based on a highfrequency of domain names; and detecting the vulnerable systemassociated with the registered misconfigured domain name.
 22. The methodof claim 21, wherein the vulnerable system is a malware-infected serversystem.
 23. The method of claim 21, wherein the vulnerable system is amisconfigured server system.
 24. The method of claim 21, wherein themetadata further comprises a geographical location associated with eachdomain name.
 25. The method of claim 21, further comprising: associatingthe registered misconfigured domain name with a server system configuredto monitor communication traffic to the registered misconfigured domainname.
 26. The method of claim 21 further comprising detecting thevulnerable system associated with the registered misconfigured domainname.
 27. The method of claim 21, wherein receiving communicationtraffic data comprises: receiving communication traffic data from atleast one Internet Service Provider (ISP).
 28. The method of claim 21further comprising comparing a relative magnitude of communicationtraffic to an expected amount of communication traffic.
 29. The methodof claim 21, wherein receiving communication traffic data comprisesmeasuring a frequency of communication traffic to the misconfigureddomain name.
 30. The method of claim 21, wherein the metadata comprisesat least one of the group consisting of: (a) geographical location ofthe communication traffic, (b) frequency of the communication traffic,(c) magnitude of the communication traffic, (d) aggregated counters of anumber of unique Internet Protocol (IP) addresses per country, (e) anumber of events observed per period, and (f) a ratio of unique IPaddresses to a sum of a portion of the communication traffic.
 31. Asystem for external detection of a vulnerable system coupled to acommunication network, the system comprising: at least one computersystems programmed to perform operations comprising: receivingcommunication traffic in the communication network to identify at leastone domain name associated with a vulnerable system, the communicationtraffic originating from at least one server system in the communicationnetwork; executing queries on the communication traffic to extractmetadata while monitoring the communication traffic; identifying thedomain name having an associated property indicative of vulnerability ofthe domain name based on the metadata, wherein the domain name havingthe associated property indicative of vulnerability comprises amisconfigured domain name; determining whether the misconfigured domainname is registered at a domain name registry; if the misconfigureddomain name is not registered, registering the misconfigured domain namebased on a high frequency of domain names; and detecting the vulnerablesystem associated with the registered misconfigured domain name.
 32. Thesystem of claim 31, wherein the vulnerable system is a malware-infectedserver system.
 33. The system of claim 31, wherein the vulnerable systemis a misconfigured server system.
 34. The system of claim 31, whereinthe operations further comprise: associating the registered domain namewith a server system configured to monitor communication traffic to theregistered domain name.
 35. The system of claim 31, wherein operationsperformed further comprise detecting the vulnerable system associatedwith the registered misconfigured domain name.
 36. The system of claim31, wherein receiving communication traffic data comprises: receivingcommunication traffic data from at least one Internet Service Provider(ISP).
 37. The system of claim 31, wherein comprising comparing arelative magnitude of communication traffic to an expected amount ofcommunication traffic.
 38. The system of claim 31, wherein receivingcommunication traffic data comprises measuring a frequency ofcommunication traffic to the misconfigured domain name.
 39. The systemof claim 31, wherein the metadata comprises at least one of the groupconsisting of: (a) geographical location of the communication traffic,(b) frequency of the communication traffic, (c) magnitude of thecommunication traffic, (d) aggregated counters of a number of uniqueInternet Protocol (IP) addresses per country, (e) a number of eventsobserved per period, and (f) a ratio of unique IP addresses to a sum ofa portion of the communication traffic.
 40. A computer-implementedmethod for external detection of a vulnerable system, the vulnerablesystem coupled to a communication network based on domain nameproperties, the method comprising: receiving communication traffic inthe communication network to identify at least one domain nameassociated with a vulnerable system, the communication trafficoriginating from at least one server system in the communicationnetwork; executing queries on the communication traffic to extractmetadata while monitoring the communication traffic; identifying thedomain name having an associated property indicative of vulnerability ofthe domain name based on the metadata, wherein the domain name havingthe associated property indicative of vulnerability comprises anabandoned domain name; determining whether the abandoned domain name isregistered at a domain name registry; if the abandoned domain name isnot registered, registering the abandoned domain name based on a highfrequency of domain names; and detecting the vulnerable systemassociated with the registered misconfigured domain name.
 41. Acomputer-implemented method for external detection of a vulnerablesystem, the vulnerable system coupled to a communication network basedon domain name properties, the method comprising: receivingcommunication traffic in the communication network to identify at leastone domain name associated with a vulnerable system, the communicationtraffic originating from at least one server system in the communicationnetwork; executing queries on the communication traffic to extractmetadata while monitoring the communication traffic; identifying thedomain name having an associated property indicative of vulnerability ofthe domain name based on the metadata, wherein the domain name havingthe associated property indicative of vulnerability comprises analgorithm-generated domain name; determining whether thealgorithm-generated domain name is registered at a domain name registry;if the algorithm-generated domain name is not registered, registeringthe algorithm-generated domain name based on a high frequency of domainnames; and detecting the vulnerable system associated with theregistered misconfigured domain name.